security: read the executor's diff before running its code

[ed-is-ai]

Re-running done criteria executes the executor's changes (including test files) unsandboxed with full user privileges. This reorders the execute review to scope check → read the diff → audit the tests → re-run done criteria, and amends the worktree note to say what the isolation actually covers: a git worktree isolates the user's working tree, not the host.

The review procedure's own rationale already treats the executor as adversarial ("Executors game criteria — a test that asserts nothing meaningful passes pnpm test and proves nothing"), and SKILL.md says to treat the diff as untrusted until reviewed — but the old order executed those tests before anyone had read them. Reading first closes that gap; the wording of each review step is unchanged, only the order and the two framing sentences moved.

🤖 Generated with Claude Code

[ed-is-ai]

ok

[ifauzeee]

Review: approve

Good security hardening. Reordering the review checklist so that scope → read diff → audit tests all happen before re-running done criteria is the right call: re-running executes the executor's code (including its test files) with the advisor's full privileges (network, env, credentials), so it should be the last step, after the diff is understood and judged in-scope.

The updated closing note ("a git worktree isolates the user's working tree, not the host") correctly reframes the isolation model — a worktree protects files, not privileges — which makes the new ordering self-consistent rather than just pedantic.

One tiny wording suggestion (non-blocking): the execute bullet in SKILL.md says "check scope, read the code, then re-run done criteria" — consider mirroring the reference file's wording ("scope → diff → tests → run") so the two documents describe the same sequence. As written they convey the same order, just with different granularity.